Skip to main content

AI Skill Prompt Guide

General guidelines​

  1. Scope the AI instructions to a single tab and a single flow.
  2. If a step involves navigation or filtering that can be expressed as path or query parameters, put it in the start URL instead of asking the AI skill to navigate and set the filters itself.
    • Example: start at http://mytool.com/threats/incident/123?fromDate=10-03-2025&toDate=12-03-2025 rather than http://mytool.com/threats/.
  3. Keep in mind that the AI skill has a limited set of interaction tools: clicking interactive elements and entering text into input elements. Asking it to perform actions it cannot technically do is an anti-pattern (e.g. "Double click on the button", "Scroll down", "Click on an empty space").
  4. Generally, it's better to define how data should be extracted in the skill's outputs than to describe it in the prompt. For example, instead of writing "Locate the user in the table and extract their information", add an output: "user_info" — "The information of the user in the table". The reason is that extraction and analysis always happen after the AI skill has finished, and the skill itself has no "locate" or "extract" actions.
  5. Avoid the words "copy" and "paste" in the instructions, as the AI skill has no clipboard. Instead, use type or enter when referring to the values passed to the inputs.
  6. Reference inputs by their input name (e.g. "Enter the provided IP"). There's no need to add formatting around the name — it can confuse the AI and make it use the literal string (e.g. "Enter 'IP'" can cause it to type the literal string "IP" instead of the input's value).
  7. When asking the AI to extract information, be specific and adhere to the terminology used by the tool (e.g. "Extract the ISP name from the first section of the results" instead of "Extract the ISP"). Avoid words such as "all", "every", "some" and "many" — an instruction like "Extract all the information about this activity" can send the AI wandering around the page in search of information, which is not ideal.
  8. Don't ask the AI skill to "sign in" or to "log in" into the tools. The signing in flow is handled automatically before the AI skill starts.

Known limitations​

  • The AI skill operates on a single tab only. It cannot open new tabs, and if an action opens one, it cannot switch to it.
  • The AI skill cannot upload files or add file attachments.
  • The AI skill can only interact with standard HTML elements such as links, buttons and text boxes.
  • Downloading a file requires a one-time permission approval by the user (in guided mode).
  • Extracting information from scrollable containers (e.g. a side panel with a scroll bar) is limited, unless it's part of the final analysis step.

Troubleshooting​

The AI step finishes before the results have fully loaded​

Sometimes the AI skill finishes before its last interaction has completed. For example, when told to "submit a form", it may click the submit button and then finish, without waiting for the form to be submitted or for the results to appear. To avoid this, tell the AI skill to explicitly wait a number of seconds in such situations (the skill has a "wait" action). For example: "After submitting the form, wait 3 seconds. If the results have still not loaded, wait another 5 seconds."

The AI step performs unnecessary actions after the main flow​

Sometimes the AI skill performs additional interactions because it can't tell that the task is complete. This typically happens when there is no clear indication that an operation has ended (e.g. a form is submitted but nothing on screen confirms it). In this case, it helps to tell the AI skill to finish explicitly after the last action. For example: "... Submit the form. Then finish."

Prompt Examples​

Prompt:

Enter the IP in the search box. Click the WhoIs button to search for the results. Verify that the IP search results are shown. Then finish.

InputsOutput
ipisp_country — The country of the ISP of the IP

Running a query in Splunk and extracting the results​

Prompt:

In the search and reporting section, run the provided Splunk query. Use "Last 7 Days" as the time range for the search. Type the query in the search textbox under "Search" and submit it. After submitting the query, wait a few seconds for the results to appear under the "Events" tab.

Inputs
query

Submitting a form in a ticket tracking system​

Prompt:

Click the "Create Ticket" button. Fill in the form that opens with the provided inputs. The inputs might not be exact values, so select the best matching option for each. Submit the form. Then finish.

Inputs
The values to enter in the form